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10 Application Number 102 36 106.1, filed on August 7, 2002. 

BACKGROUND OF THE INVENTION 

1. Field of the Invention 

IS The invention relates to a method and a safety system for 

a locking device for a motor vehicle. 

2 . Prior Art 

From the prior art it is known to use serial data 
30 protocols of a bus technology in the motor vehicle for data 
transfer between electronically controlled devices. Thus by 
way of example the individual body control devices are linked, 
such as the central body electronics, combination instruments 
and control devices in the doors . From the central body 
25 electronics, a central control device in the motor vehicle, 
trigger signals are generated more particularly for the 
central locking function and are transferred to the executing 
control devices by means of a serial data protocol . The 
locking function is thereby dependent on these trigger 
30 signals . 

Furthermore it is known in the event of a complete 
breakdown of the bus system to switch the door control devices 
over automatically into an emergency operating mode in order 
to enable the functions pertaining to safety which are 
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dependent on being triggered. It has however been seen that 
even with a breakdown of one part of the electronics which are 

5 connected through the bus (central control device or further 

instruments of the motor vehicle connected thereto) important 
or even all functions of the displacement systems can be 
blocked because a failed electronics " unit could no longer 
supply the data which was necessary to generate the trigger 

10 signals. Such emergency operating modes for window lifters 
are known for example from EP 1 060 922 A or DE 199 28 101 C2 . 

Furthermore the technical functioning of the displacement 
systems is dependent on the functional ability and reliability 
of the control devices. Breakdown situations which lead to a 

15 partial failure of the control electronics run the risk of 
generating parasitic resistances which clearly reduce 
insulation between two conductor paths of the electronics of 
the door control device. Parasitic resistances caused in this 
way can have values of some hundred ohms. If this resistance 

20 arises between a control connection of a power switch and a 
fixed potential, more particularly the battery voltage or the 
earth connection, then this can lead to undesired control of 
the power switch and consequently to an undesired adjustment 
of the displacement device. 

2$ The breakdown of parts of the vehicle electronics, more 

particularly the bus system or the control device through 
crash effects can lead to the undesired displacement of the 
displacement device in the emergency accident situation and to 
additional dangers. 

SUMMARY OF THE INVENTION 

The object of the invention is to provide a method and 
system for safeguarding a locking device of a motor vehicle 
which enables the opening of the locking device in the event 
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of a breakdown of parts of the system, and at the same time 
reduces the risk of automatic responses in a non-desired state 

S or manual faulty functions. 

According to this object, a safety system is provided for 
a locking device of a motor vehicle , the safety system 
comprising — whoroin a control device which is — a — oonatituonfe 
part of — the safety oyatom, — ^has at least one power switch for 

10 oontrolling — actuating an electromechanical unit into the 
[ ["] ]blocking[ ["] ] state, also termed [ [ " ] ] saf e [ [ " ] ] 
state[[,]] and which can additionally be influGnccd controlled 
through a central control device. This blocking state differs 
from the locking states "unlocked" and "locked" of the locking 

IS device of the vehicle door. 

If the electromechanical unit is in the 
[ ["] ]unlocked[ ["] ] state then — the motor vehicle door can be 
opened manually both from outside and from inside the vehicle^ 
In addition, or the motor vehicle door is — fee — can b e opened 

20 automatically by means of a motorize d drive central locking 
system . 

In the [["]] locked [["] ] state the motor vehicle door is 
can no longer to b e opened from the outside of the vehicle, 
but furthermore still all mechanical functions of the 

25 electromechanical unit are activated^ so that the motor 
vehicle door ia to can b e opened from inside of the vehicle. 
which — is The opening may also still be p ossible from the 
outside by an extra aid through — using a eear - roepondi ng 
predefined tool , in case ohould the vehicle user have boon h as 

30 accidentally been locked out of the vehicle . 

In order to prevent theft of the vehicle, the 
electromechanical -units of the motor vehicle aaee — can be m oved 
into the [ [ " ] ] blocking [ [ - ] ] state. In the [ ["] ] blocking [["] ] 
state all mechanical functions of the electromechanical unit 

3S 
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are deactivated^ so that the vehicle door cannot be opened fey 
the auxiliary u sing the predefined tool or manually from the 

5 inside of the vehicle — throug h — febe — actuation — ei — mochanical 

Gompononto of feho oloGtromGchanical unit . 

These different states are caused through the 
electromechanical unit which produces at least the states 
[ [»] ]unlocked[ ["] ] [ ["] ] locked[ ["] ] and [ ["] ]blocking[ ["] ] 

10 through the supply of electrical energy by means of mechanical 
adjustments. The states described can in principle be 
different for the relevant vehicle doors or also a trunk door 
of the motor vehicle. 

The states of all the locking units of one vehicle are 

15 preferably tuned with each other through the central control 
device by means of serial data protocols. 

For this a central control device is provided which has 
signal links, more particularly a serial bus connection to the 
control devices of the relevant door of the motor vehicle. 

20 These signal links enable data transfer to produce the desired 
states in that the electromechanical unit can be controlled 
through the central control device via the signal links. By 
way of example the signal links enable a data transfer to 
transmit the desired states from the central control device to 

25 the relevant control devices for controlling the local locking 
device . 

Data transfer is constituted in a simple case by a 
signal, a voltage or binary data aaaignGd to b eing indicative 
of the relevant situation. More complex links enable an 
30 improvement in the reliability of the transfer and the 
transfer of commands, status data and/or diagnosis data of the 
electromechanical unit or from operating elements. 

In order to provide a secure thio — system^ the door 
control device is connected to the central control device 

m 
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through an electrical lead connection which is independent of 
the signal links. For the lead connection to be independent 

5 from the signal links, indopGndoncG — ei — this — olGGtrical — load 

GonnoGtion — it is necessary that the voltages or signals 
transferred through - v ia the signal links do not diaturb thia 
influence the independent electrical lead connection. A 
particularly expedient simple design of the invention proposes 

10 that a separate conductor which is electrically insulated from 
the signal links is used as the independent electrical lead 
connection. 

A potential of a control connection of the previously 
mentioned power switch can be controlled by the central 

15 control device through this independent electrical lead 
connection for energizing the electromechanical unit or a 
power connection of the control device which can be connected 
to the electromechanical unit. The . control is preferably 
undertaken directly by connecting the control connection or 

20 power connection electrically and directly to the central 
control device through the independent electrical lead 
connection. Alternatively the potential of the relevant 
connection could also be controlled indirectly by the central 
control device by switching a further logic element, by way of 

25 example a switch transistor in between the independent 
electrical lead and the relevant connection. 

Consequently the oontrol actuation is carried out with an 
additional rolcaQG — dopondGncG — through — enabling control being 
provided via the independent electrical lead connection from 

30 by the central olGGtronico control unit to the relevant local 
control devices, wherein whoroby — ^without this rolGQac — a 
control enabling an actuation of the electromechanical unit ie 

Hot possible into the [ [ " ] ] blocking [ [ " ] ] state is not 

possible . 

35 
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According to a further advantageous embodiment of the 
invention the central control device only rclcasGS — enables the 

5 control — actuation of the electromagnetic unit into the 
[ ["] ]blocking[ ["] ] direction when the functional capacity of 
the serial data transfer is ensured through the signal link, 
which can happen for example through a continuous status 
enquiry of all the control devices and central control devices 

10 involved. For this the central control device has 

advantageously an evaluation device which is designed for 
controlling the power connection in dependence on a state or 
an emergency operation of the signal links. This evaluation 
device interrogates cyclically for example the junctions of a 

15 bus system of the signal links in order to check their 
functional ability and the functional ability of the signal 
links. More advantageously, additional vehicle states are 
evaluated, more particularly the ignition state. A switched- 
off ignition is thereby a further condition for controlling 

2Q the potential of the control connection. If at least one 
condition is not fulfilled, for example the failure of the 
serial data protocol as a result of physical actions in the 
event of a crash, the roloaoc — enabling condition is not 
fulfilled, i.e. this is set back so that the potential to the 

25 independent electrical lead connection is not controlled 
through the central control device. 

An advantageous development of the invention proposes 
that for control the potential can be switched to this 
independent electrical lead connection. Preferably the output 

30 of the central control device has for this switch process a 
low-resistance output which clearly reduces the tendency of 
this independent electrical lead connection to react 
sensitively to breakdown factors . A low-resistance output of 
this kind is achieved for example by using switch transistors 

35 
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which have in addition to the connection to the independent 
electrical lead connection a further connection to a current 
S or voltage source, by way of example to a battery voltage or 

to earth. 

As a result of the low output resistance parasitic 
resistances which may appear in accident situations only have 
a slight influence on this potential bearing on the 

10 independent electrical lead connection. Furthermore in 
another embodiment of the invention the switching of the 
battery voltage or earth connection provides the possibility 
of transferring through this independent electrical lead 
connection the drive energy for the electromechanical unit at 

15 least for an adjusting direction. 

In a further development of the invention the central 
control unit has at least one switch for switching at least 
two different potentials. These potentials are by way of 
example the said earth potential or the battery voltage 

20 potential. If on the other hand a digital evaluation of the 
potential is preferred then a logic level, for example a level 
of 5 volt can also be used as one of the two different 
potentials. By way of switching over the two potentials it 
avoids that in one time state a high— resistance output of the 

25 central control device leads to an undefined potential at the 
independent electrical lead connection. 

In order to further increase the security of this safety 
system, in a particularly advantageous development of the 
invention for controlling the [["]] blocking [["] ] state the 

30 control of the potential through the central control device 
and a control through the logic of the control device are 
logically AND-linked. The logic of the door control device is 
thereby for example a micro controller integrated in the door 
control device which can in turn be connected through one of 

3,5 
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the signal- links to the central control device. Through this 
logic AND- link a safety redundancy is generated which further 

5 reduces the influence of parasitic resistances. Furthermore 

it can be checked when checking the input states of the logic 
AND-link whether the control device of the door and the 
central control device are in the normal operating mode. 

An advantageous development of this design of the 

IS invention proposes that for the logic AND-link the switch of 
the central control device and a switch of the logic of the 
door control device form a series connection. The switches 
are preferably mechanical switches, more particularly switch 
transistors which in turn have a control connection. A first 

15 sub-variation of this development of the invention proposes 
that both switches are connected together electrically 
directly. Alternatively this second sub variation of this 
development proposes that both switches are connected together 
through a further element more particularly through at least 

20 one connection of the power switch or power connection of the 
door control device. The potential for controlling the power 
switch is preferably switchable between the earth potential 
and a control potential which can be less than or equal to the 
battery potential. 

25 In order to achieve a further increase in the safety of 

this safety system in a further advantageous development of 
the invention in each local control device for controlling the 
electromechanical unit a preferably permanent plausibility 
check takes place in which the rolGaso — ^potential of the 

30 independent electrical lead connection is only then owitched 

^ when applied if the conditions "ignition off" and 

"undisturbed signal connections* are met . 

A preferred embodiment of the invention proposes that the 
connections are a constituent part of a bus system. This bus 

35 



AMENDED SPECXFICATION SHOWING CHANGES 

1 54186/MEG/M521 

system is preferably a CAN-bus system which enables a link 
with the central control device and further devices of the 

5 motor vehicle. If at least a bi-directional link, for example 

that of a CAN-bus, is used then a transfer of status data is 
possible between the devices of the motor vehicle. In 
addition to the status data, further information on an 
operating mode, for example an emergency operation during an 

W accident situation or a defect in the devices and a normal 
operating mode, can be transferred. Further developments of 
this embodiment additionally permit a transfer of diagnostic 
data through the CAN-bus system which register the updated 
reliability of individual elements of the safety system, more 

15 particularly the reliability of the potentials and the 
independent electrical lead connection to the central control 
device. 

A particularly advantageous development of the invention 
proposes that the control device has a micro controller. A 

20 constituent part of this micro controller is for example a 
logic which enables the logical AND-link to the control of the 
central device. Furthermore this micro controller serves to 
control and evaluate further operations of the function 
elements of the motor vehicle door. This micro controller is 

25 furthermore connected for control to the power switch through 
its control connection. For this an output PIN of the micro 
controller can be connected directly to a discrete power 
switch in the form of a power transistor or a relay. 
Alternatively an indirect switching is also possible through a 

30 further logic of the control device of the door or through a 
logic of the central control device. For controlling the 
relay the connection can advantageously be through a driver 
transistor for energizing the relay coil. As an alternative 
to the connection through lead elements of a plate it is 

-a- 
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possible to integrate the micro controller together with the 
power switch on a semiconductor chip as so-called smart power 

5 technology. 

In a further advantageous development of the invention it 
is proposed that the micro controller of the control device is 
in active connection with the independent electrical lead 
connection for evaluation. This active connection enables the 

10 detection of states and faulty functions of the lead 
connection or signals or potentials being transferred. These 
faulty functions can be evaluated by the control device or 
alternatively in an advantageous development of this form of 
the invention it is proposed that the micro controller of the 

15 control device transfers through one of the signal links a 
status of the potential of the control : connection of the lead 
switch or the state of the electromechanical unit to the 
central control device. In this case an evaluation of the 
detected states and functional abilities through the central 

2Q control device is possible in that this evaluates all time 
changes detected by the control device and registers by means 
of a plausibility check any deviation from a normal operation 
and where applicable starts an emergency operation. In this 
emergency operation mode a release is now consequently changed 

25 by way of example to control — actuate the electromechanical 
unit into the [ ["] ]blocking[ ["] ] direction. 

In a further advantageous development of the invention a 
window lifter drive of the motor vehicle door can be roloaood 
enabled to be actuated in the [["]] closing [["] ] direction 

3D through the independent electrical lead connection. By moana 
— thia — control of controlling the window lifter otatos via 
the electrical lead connection , it is to -can b e prevented that 
an automatic closing operation of the window lifter is 
provcntcd disabled in an emergency operating situation. If 

IS 
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tho a critical state of the electromechanical unit is already- 
reached and an unlocking is no longer possible^ the a — in an 

5 emergency operating case the window lifter drive is controlled 

so that automatic opening of the window pane for this 
emergency operation is possible. 

One method for securing this adjusting device of a motor 
vehicle can be used with particular advantage. For this for 

10 example it is possible to use the safety system previously 
outlined or a modified safety system. Advantageously for 
controlling a lock of the vehicle in the [ ["] ]blocking[ ["] ] 
(safe) state in a first method step the functional reliability 
of a central control device and its connections are evaluated. 

15 In order to determine the operating state of the vehicle a 
characteristic value is evaluated. This characteristic value 
is for example the switched state of the ignition of the 
vehicle, so that [ ["] ]blocking[ ["] ] of the vehicle is not to 
take place when the ignition is switched on. 

20 If the operating state of the vehicle for a 

[ ["] ]blocking[ ["] ] through the lock represents no danger for 
the occupants of the vehicle then a potential for controlling 
the lock is switched to an electrical lead connection which is 
independent of the signal links. A control command is 

25 transferred through one of the signal links of the central 
control device to a control device. If through the evaluation 
a fault- free functioning of the devices and the signal link is 
detected, then an electromechanical unit of the lock is 
energized through a power switch of the control device of the 

30 door and the lock is switched to the [["]] blocking [["] ] state. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The invention will now be explained in further detail 
with reference to embodiments illustrated diagramraatically in 

35 
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the drawings: 

Figure 1 shows a motor vehicle with communications 

structure; 

Figure 2 shows a block circuit diagram of a safety- 

system; 

Figure 3 shows a circuit plan of a safety system; 

and 

Figures 4a and 4b show a flow chart of a safety process. 
DETAILED DESCRIPTION OF THE DRAWINGS 

15 Figure 1 shows diagrammatically a motor vehicle. For 

communication this motor vehicle has a central control device 
ZSG which can be controlled optically or by radio by means of 
a remote control RC, by way of example by a vehicle key. This 
central control device ZSG is connected through a bus system 

20 CAN to door control devices TSG 1, TSG 2, TSG 3 and TSG 4. 
The door control devices TSG 1, TSG 2, TSG 3 and TSG 4 are 
disposed in the four doors of the motor vehicle. Connections 
of the bus communications structure CAN are laid in the 
vehicle doors from inside the vehicle through door partitions 

25 TSS 1, TSS 2, TSS 3 and TSS 4 and are there connected to the 
door control devices TSG 1, TSG 2, TSG 3 and TSG 4. 

A block circuit diagram of the safety system is 
illustrated in Figure 2 . Figure 2 shows by way of example a 
door control device TSG which is connected through an 

3Q interface TSS to the central control device ZSG as well as a 
battery of the vehicle Bat. An analogous structure is also 
produced for the other door control devices of the motor 
vehicle. The battery Bat has two connections B and GND for a 
battery voltage potential Ub and the earth connection GND. 

35 
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Both connections are connected both to the central control 
device ZSG and to the door control device TSG. The central 

5 control device ZSG has a micro controller |jiCl and a CAN- bus 

interface CAN. The CAN-bus interface CAN is connected through 
the CAN-bus CAN through the door partition TSS to a CAN-bus 
interface CAN of the door control device TSG. A further 
connection, St, control lead is independent of the CAN-bus and 

ID exists between the central control device ZSG and the door 
control device TSG. For controlling the potential of the 
independent electrical control lead St the central control 
device ZSG has two potential switches PSl and PS2 whereby the 
first potential switch (control switch) PSl is connected to 

15 the battery voltage potential Ub and to the control lead St. 
The second potential switch (control switch) PS2 is however 
connected to the control lead St and to earth GND. 

The door control device TSG is apart from the link to the 
central control device ZSG through the CAN-bus system CAN and 

20 the independent electrical control lead St, as well as from 
the supply lead to the motor vehicle battery Bat, also 
connected to further function units of the vehicle door. Two 
electromechanical adjusting drives Ml and M2 are connected to 
the door control device TSG which has power switches LSI and 

25 LS2 for energizing the two drives Ml and M2 . The first 
adjusting drive Ml is an adjusting drive of a vehicle lock 
wherein this adjusting drive Ml serves to lock and unlock the 
vehicle door. The second electromechanical drive M2 serves to 
switch the same lock into the [ ["] ] blocking [ ['] ] state, thus a 

30 so-called safe state . 

In order to oner gi go — thio — actuate the second adjusting 
drive M2 by means of the second power switch LS2 , thio the 
second power switch LS2 is connected by means of the control 
lead St directly — to the central control device ZSG. The 

3:5 
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second power switch LS2 as well as the first power switch LSI 
arc formod ao are constituted by m echanical power switches in 

5 the form of relays or the like or a& -are constituted by full- 

or semi -bridged semiconductors. The power switches LSI and 
LS2 have for this several control inputs (not shown in Figure 
2) . These control inputs are connected to the micro 
controller \iC2 of the door control device TSG and control lead 

10 St or further input wiring. 

In order to move the lock into the [ [ " ] ] blocking [ [ " ] ] 
state it is first checked whether the safety system is in the 
normal operating mode. The central control device ZSG then 
switches the control lead St by means of the potential switch 

15 PSl to the operating voltage potential Ub of the battery Bat, 
For this the second potential switch PS2 which has connected 
the control lead St previously to the earth is opened. At the 
next stage the central control device ZSG sends via the CAN- 
bus CAN a signal into the door control device TSG which 

2D contains a command to energize the second electromechanical 
drive unit M2 . 

The circuit plan illustrated in Figure 3 shows a section 
of the more specific design of the embodiment shown in Figure 
2 . In Figure 3 ^feiie — d oor — partition — TSS — is — shown — with — fefee 

25 connections from the central control device ZSG to the door 
control device TSG — which — have — boon — laid — through — fefee — door 
partition- TSS are shown, the connections being constituted by 

-5 The GonnoGtion is thoroby the control lead St the battery 

voltages -connection U b as well as the earth connection GND. 

30 The CAN-bus system CAN is in turn provided for communication 
between the door control device TSG and the central control 
device ZSG. The door control device TSG is in turn connected 
to a lock Sch of a vehicle door through three current leads. 
The lock Sch of the vehicle door is mounted in a wet space N 

■35 
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of the vehicle door on one side of a wet/dry separation NT and 
is suitably sealed against the penetration of damp. 

5 On the other side of the wet/dry separation NT the door 

control device TSG is mounted on the dry space side T of the 
vehicle door and has no adequate damp protection from the wet 
space N, For communication between the door control device 
TSG and the central control device ZSG through the CAN-bus CAN 

10 the micro controller ^iCl of the central control device ZSG and 
the micro controller \iC2 of the door control device TSG are 
connected together through transceiver circuits Trans 1 and 
Trans 2 which provide suitable hardware for the CAN-bus 
control. Additionally the micro controller \xCl of the central 

15 control device ZSG is connected with a control connection with 
a field effect transistor JFET which enables the battery 
voltage Ub to be switched to the control lead St. 

The micro controller \iC2 of the door control device TSG 
has three outputs which are each connected through resistances 

30 Rl, R2 or R3 to driver transistors, in this case NPN bipolar 
transistors Ql, Q2 and Q3 . The driver transistors Ql, Q2 and 
Q3 are each connected to a relay coil Inl, In2 and In3 of a 
relay Rll, Rl2 and R13 respectively, the driver transistors 
Ql, Q2 and Q3 thereby switch the connections of the relay 

25 coils Inl, In2 , In3 to earth. The other relevant connection 
of the relay coils Inl and In2 is connected to the battery 
voltage Ub, whilst the relay coil In3 is connected to the 
second connection to the control lead St. This third relay 
R13 serves to energize the second electromechanical drive unit 

30 M2 of the lock Sch in the direction of the blocking state 
"Safe" . 

In order to switch the lock into the blocking state the 
control St lead must consequently be switched by the field 
effect transistor JFET of the central control device ZSG to 
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battery voltage potential Ub and at the same time the driver 
transistor Q3 has to be switched through the micro controller 

5 HC2 of the door control device TSG via the third resistance 

R3 . Consequently aa a condition in order to operate the lock 
in the [ ["] ]blocking[ ["] ] state, an AND link io required of 
the output volta - go of the micro cont - rollcr |j.C2 adjoining the 
driver transistor Q3 with — fehe — switched — and field effect 

10 transistor JFET of the central control device ZS G must both be 
conducting, thus fulfilling a logical AND-condition . 

The relay switches SI, S2 and S3 are provided for the 
actual energizing of the drive units Ml and M2 of the lock 
Sch. These relay switches are connected on the one hand to 

15 earth GND and on the other to the battery voltage Ub. The 
relay switch S3 of the third relay R13 can be connected 
selectively to the battery voltage Ub or to the control lead 
St through a so-called jumper or bridge Jp, If the relay 
switch S3 is additionally connected to the control lead St 

20 then the second drive unit M2 of the lock Sch is energized 
through the control lead St . 

Instead of the relays Rll, R12 and Rl3 illustrated in 
Figure 3 it is also possible to use as an alternative power 
semiconductors which can also be integrated in the micro 

3S controller iiC2 as smart power elements. If the semiconductor 
power switches are formed as discrete elements then their 
control is preferably counter-phased, in order to obtain with 
the appearance of a parasitic resistance a same-phased 
breakdown voltage on the control connections of the discrete 

30 power switches which does not cause any undesired switching 
through of the power transistors. This is particularly the 
case since the parasitic resistances act the same on parallel 
mounted conductor paths which serve to control these discrete 
power switches . 

3S 
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Figures 4a and 4b show a procedure for securing a motor 
vehicle lock diagrammatically by means of a flow chart. In a 

S first step the central control device ZSG receives the command 

"safe", thus to move the motor vehicle doors into the 
[ ["] ]blocking[ ["] ] state. This can be carried out by way of 
example through a remote control or the actuation of one of 
the locks by means of a vehicle key. In a second step it is 

iO checked whether the connections of the CAN-bus system function 
fault-free. For this the central control device ZSG can check 
for example at least the door control devices TSG of the motor 
vehicle doors for functioning ability. If functioning ability 
of the CAN- bus connection is provided then in a third step 

IS the interrogation of a CAN value of the motor vehicle is 
carried out in this embodiment according to the state of the 
engine ignition. 

If in this third atago — step the engine ignition is 
switched on through the ignition key^ eae — fefee — liko — then in a 

20 fourth step in Figure 4a the potential is applied to an 
independent electrical lead connection St — is — owitchcd — e##. 
Then in a fifth step a safe control command is sent to the 
door control devices TSG from the central control device ZSG 
via the bus system CAN. If in the second step a fault has 

25 appeared in the CAN bus communication or if the engine 
ignition is inactive, then — in a sixth step a fault is 
indicated through the safety system. Then in a seventh step 
the fault is protocolled in a file and made available for a 
later fault diagnosis , 

30 Figure 4b shows the second part of the safety method 

through the safety system which proceeds in the door control 
device TSG. After the fifth step of Figure 4a , the transfer 
of the safe control command through the CAN-bus to the door 
control device TSG, the control potential of the control lead 

35 
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St is checked in the door control device TSG through its micro 
controller \iCl. If the control potential corresponds to the 

S potential for blocking the vehicle door, then in a ninth step 

a plausibility check of the overall system takes place in 
which for example the communications system as well as the 
functional ability of the door control device TSG is checked. 

If the plausibility check also produces a positive result 

1.0 then in the tenth method step the lock, Sch is controlled into 
the blocking "aafo" — state. If in step eight the control 
potential is unsuitable for controlling the second 
electromechanical unit M2 in the blocking direction, then in 
step eleven a diaplay ia provided - on tho dof octivo otato of a 

IS notification is displayed that the overall locking system, for 
example a central locking system (contral — control — — locks) 
Z V, is in a defect state . Similarly in the eleventh step the 
display of a defect in the central locking system ZV takes 
place if the plausibility check of the ninth method step 

20 produces a negative result. In this case in addition to the 
display in the method step eleven the lock is controlled in a 
twelfth step in the unlocking direction, in order to be able to 
ensure that any person who may be in the vehicle can leave the 
vehicle if the lock was not able to pass into the blocking 

25 (safe) state. 

Accordingly the detection of a fault triggers a display 
of a critical state in a vehicle display for the vehicle user 
and the door locks are controlled into the [["unlocked"]] 
state. An end position in the [["safe"]] region is 

30 consequently possible through the lock mechanism only via the 
intermediate position [ [ " ] ] locked [ [ " ] ] so that in the event of 
a fault two conditions have to be met in order to bring the 
vehicle door from the [ [ " ] ] unlocked [ [ " ] ] state into the 
[ [ " ] ] locked [["]] state. 

3.E: 
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